A critical local file inclusion vulnerability in the ThemeREX Gridiron theme allows unauthenticated attackers to potentially read sensitive system files.

This is a local file inclusion (CWE-98) vulnerability occurring within the theme's PHP file handling logic. The vulnerability is accessible to unauthenticated attackers via network vectors, as indicated by the CVSS vector AV:N/PR:N.

The ability to perform local file inclusion can lead to the unauthorized disclosure of sensitive server-side files, including configuration files, credentials, or source code. Given the CVSS score of 8.1, this vulnerability poses a high risk of total impact to confidentiality, integrity, and availability, which could result in full system compromise or significant data breach.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or remove the Gridiron theme until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or attempts to include unexpected PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion and directory traversal attack payloads.

Public Exploit Available: Unknown.

Given the high severity of this file inclusion vulnerability, organizations utilizing the ThemeREX Gridiron theme should treat this as a priority. Immediate mitigation through deactivation is necessary to prevent potential unauthorized access to the underlying server environment until the vendor provides a verified security update.